@sequenceholdings/artifact-studio 0.8.0 → 0.9.0

package/dist/gateway/server.js

@@ -4,7 +4,7 @@ import { z } from 'zod';
 import { ArtifactTunnelBroker } from '../tunnel/index.js';
 import { assertSafeRequest, normalizePublicOrigin } from '../tunnel/protocol.js';
 import { GatewayControlError } from './control.js';
-import { decodeGatewaySession, gatewaySessionCookies, renewGatewaySession, signGatewayContext } from './session.js';
+import { decodeGatewaySession, gatewaySessionCookies, renewGatewaySession, signGatewayRequest } from './session.js';
 import { proxyHostedArtifact } from './hosted-proxy.js';
 import { bootstrapPage } from './bootstrap-page.js';
 import { routeSequenceRequest } from './lattice-invoke.js';
@@ -95,7 +95,9 @@ export function createArtifactGateway(options) {
     const authorizations = new PositiveDecisionCache({ ttlMs: options.authorizationCacheTtlMs });
     const tunnelAuthorizations = new PositiveDecisionCache({ ttlMs: options.authorizationCacheTtlMs });
     const usage = new GatewayUsageReporter({ send: events => options.control.usage(events), onFailure: failure => options.onError?.(failure) });
+    const requests = new Set();
     let draining = false;
+    let drainPromise;
     const isIngressRequest = (request) => resemblesIngressHost({ rawHost: header(request, 'host'), runtimeDomain: options.runtimeDomain });
     const staticFiles = options.staticFiles ?? new StaticArtifactFiles({ fetch: ({ deploymentId, path }) => options.control.staticFile({ deploymentId, path, parentOrigin }) });
     /** Admission for the unauthenticated endpoints; the release frees the in-flight permit. */
@@ -173,10 +175,11 @@ export function createArtifactGateway(options) {
         const target = await decision.promise;
         const requestId = randomUUID();
         // A static deployment has no server of its own to read a request context.
-        const result = { session, target, requestId, authorizationCache: decision.source, requestContext: target.kind === 'static' ? '' : signGatewayContext({
-                session: { ...session, lattice: target.lattice, taskRoutes: target.taskRoutes }, method, path: request.url ?? '/', privateKey: options.contextPrivateKey, keyId: options.contextKeyId,
-                capabilities: target.capabilities, serviceAccountId: target.serviceAccountId, requestId,
-            }) };
+        const signed = target.kind === 'static' ? { requestContext: '' } : signGatewayRequest({
+            session: { ...session, lattice: target.lattice, taskRoutes: target.taskRoutes }, method, path: request.url ?? '/', privateKey: options.contextPrivateKey, keyId: options.contextKeyId,
+            capabilities: target.capabilities, serviceAccountId: target.serviceAccountId, requestId,
+        });
+        const result = { session, target, requestId, authorizationCache: decision.source, ...signed };
         activeRequests.set(request, result);
         return result;
     }
@@ -206,7 +209,8 @@ export function createArtifactGateway(options) {
             const authorized = await authorize(request);
             if (authorized.target.kind !== 'development' || authorized.target.sessionId !== sessionId)
                 return null;
-            return { ownerId: authorized.session.ownerId, publicOrigin: authorized.session.publicOrigin, requestContext: authorized.requestContext };
+            return { ownerId: authorized.session.ownerId, publicOrigin: authorized.session.publicOrigin, requestContext: authorized.requestContext,
+                ...(authorized.requestAuthentication ? { requestAuthentication: authorized.requestAuthentication } : {}) };
         },
         validateLease: async (lease) => {
             const credential = leases.get(lease.sessionId);
@@ -247,14 +251,24 @@ export function createArtifactGateway(options) {
     const proxyDevelopment = options.ingress?.appEnv === 'development' ? createDevelopmentIngressProxy({ broker }) : undefined;
     const ingress = createIngressHandler({ options: options.ingress, runtimeDomain: options.runtimeDomain, protocol: new URL(gatewayOrigin).protocol, isDraining: () => draining, onError: options.onError, usage, proxyDevelopment });
     const server = createServer({ maxHeaderSize: 32 * 1024, requestTimeout: 60_000, headersTimeout: 15_000 }, (request, response) => {
+        // server.close() can run before a destroyed response emits close. Join that event's
+        // usage finalizer AND the handler: authorization may finish after the browser disconnects.
+        const finished = new Promise(resolve => {
+            response.once('finish', resolve);
+            response.once('close', resolve);
+        });
+        const track = (handler) => {
+            const settled = Promise.allSettled([handler, finished]).then(() => { requests.delete(settled); });
+            requests.add(settled);
+        };
         // Before readiness, bootstrap and requestOrigin(): an ingress host, canonical or not, never
         // reaches a session-path handler or the 401/404→403 remap below (design §(e) "Branch placement").
         if (isIngressRequest(request)) {
-            void ingress.handle(request, response);
+            track(ingress.handle(request, response));
             return;
         }
         const startedAt = new Date().toISOString(), started = performance.now();
-        void (async () => {
+        track((async () => {
             if (isReadinessRequest({ request, gatewayOrigin, runtimeDomain: options.runtimeDomain })) {
                 const ready = !draining && (options.ready?.() ?? true);
                 json(response, ready ? 200 : 503, ready ? 'ready' : 'unavailable');
@@ -294,7 +308,7 @@ export function createArtifactGateway(options) {
                 }
             }
             const authorizationStarted = performance.now();
-            const { session, target, requestContext, requestId, authorizationCache } = await authorize(request);
+            const { session, target, requestContext, requestAuthentication, requestId, authorizationCache } = await authorize(request);
             // Immutable files Atlas already authorized this session for: no admission, context or usage.
             if (target.kind === 'static') {
                 await serveStaticTarget({ request, response, target, files: staticFiles, renew: () => renewCookie({ options, request, response, session, target }), parentOrigin: session.bridge.parentOrigin });
@@ -340,7 +354,7 @@ export function createArtifactGateway(options) {
             if (response.destroyed)
                 return;
             const { body } = await admitHostedMutation({ request, expectedDeploymentId: target.deploymentId, expectedFrameworkBuildId: target.frameworkBuildId, active: target.active, published: session.published });
-            await proxyHostedArtifact({ request, response, target, requestContext, body, limits: { timeoutMs: admitted.timeoutMs }, gatewayTimings });
+            await proxyHostedArtifact({ request, response, target, requestContext, requestAuthentication, body, limits: { timeoutMs: admitted.timeoutMs }, gatewayTimings });
         })().catch(error => {
             options.onError?.({ kind: error instanceof ReleaseAdmissionError ? 'release_mismatch' : error instanceof GatewayControlError ? 'authorization_denied'
                     : error instanceof ArtifactAdmissionError ? 'admission_rejected' : 'request_failed' });
@@ -348,7 +362,7 @@ export function createArtifactGateway(options) {
             if (error instanceof ArtifactAdmissionError && error.retryAfterSeconds && !response.headersSent)
                 response.setHeader('retry-after', String(error.retryAfterSeconds));
             json(response, status === 401 || status === 404 ? 403 : status, error instanceof ReleaseAdmissionError ? 'update_required' : 'artifact_request_failed');
-        });
+        }));
     });
     server.on('upgrade', (request, socket, head) => {
         void (async () => {
@@ -366,6 +380,10 @@ export function createArtifactGateway(options) {
                 return;
             }
             const authorized = await authorize(request);
+            if (draining) {
+                rejectUpgrade(socket, 503);
+                return;
+            }
             if (authorized.target.kind !== 'development') {
                 rejectUpgrade(socket);
                 return;
@@ -378,18 +396,31 @@ export function createArtifactGateway(options) {
         handleClientErrors({ server, ingress });
     return {
         server,
-        /** Observations recorded but not yet confirmed by Atlas: what a forced exit would lose. */
+        /** Recorded observations not yet confirmed by Atlas; excludes responses still in flight. */
         get pendingUsage() { return usage.pending; },
-        async drain() {
+        drain() {
+            if (drainPromise)
+                return drainPromise;
             draining = true;
+            broker.beginDrain();
+            const closed = new Promise(resolve => server.close(() => resolve()));
             server.closeIdleConnections();
-            broker.close();
-            leases.clear();
-            authorizations.clear();
-            tunnelAuthorizations.clear();
-            // The usage timer keeps flushing while in-flight requests finish.
-            await new Promise(resolve => server.close(() => resolve()));
-            await usage.close();
+            drainPromise = (async () => {
+                while (requests.size)
+                    await Promise.all(requests);
+                // Active responses may have become idle since close() first stopped admission.
+                server.closeIdleConnections();
+                // Keep lease checks and revocation live until local and remote HTTP streams finish.
+                await broker.drain();
+                await closed;
+                while (requests.size)
+                    await Promise.all(requests);
+                leases.clear();
+                authorizations.clear();
+                tunnelAuthorizations.clear();
+                await usage.close();
+            })();
+            return drainPromise;
         },
     };
 }

package/dist/gateway/session.d.ts

@@ -1,6 +1,11 @@
 import { z } from 'zod';
 export declare const GATEWAY_SESSION_COOKIE = "__Host-atlas-artifact-session";
 export declare function gatewayReleaseCookieName(deploymentId: string): string;
+/** Only the authenticated Atlas bootstrap control reply supplies this private cookie member. */
+export declare const gatewayAuthenticationSchema: z.ZodObject<{
+    method: z.ZodLiteral<"auth0_user">;
+    sub: z.ZodString;
+}, z.core.$strict>;
 declare const sessionSchema: z.ZodObject<{
     version: z.ZodLiteral<1>;
     kind: z.ZodEnum<{
@@ -30,6 +35,10 @@ declare const sessionSchema: z.ZodObject<{
         processId: z.ZodNullable<z.ZodString>;
     }, z.core.$strict>>;
     taskRoutes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    authentication: z.ZodOptional<z.ZodObject<{
+        method: z.ZodLiteral<"auth0_user">;
+        sub: z.ZodString;
+    }, z.core.$strict>>;
 }, z.core.$strict>;
 export type GatewaySession = z.infer<typeof sessionSchema>;
 /** Active use renews the idle window, but never extends the original admission's eight-hour bound. */
@@ -85,4 +94,9 @@ export declare function signGatewayContext({ session, method, path, privateKey,
     /** Seconds until exp. Browser requests stay at 60; a Lattice run may last up to 300. */
     ttlSeconds?: number;
 }): string;
+/** Signs a proof only for the exact context this call just minted from its authenticated session. */
+export declare function signGatewayRequest(input: Parameters<typeof signGatewayContext>[0]): {
+    requestContext: string;
+    requestAuthentication?: string;
+};
 export {};

package/dist/gateway/session.js

@@ -1,8 +1,9 @@
-import { createHmac, createPrivateKey, randomUUID, sign, timingSafeEqual } from 'node:crypto';
+import { createHash, createHmac, createPrivateKey, randomUUID, sign, timingSafeEqual } from 'node:crypto';
 import { z } from 'zod';
 import { ARTIFACT_CONTEXT_MAX_AGE_SECONDS, ARTIFACT_LATTICE_CONTEXT_MAX_AGE_SECONDS, artifactRequestContextSchema } from '../server/request-context.js';
 import { normalizePublicOrigin } from '../tunnel/protocol.js';
 import { artifactNextFrameworkBuildIdSchema } from '../runtime-contracts.js';
+import { ARTIFACT_REQUEST_AUTHENTICATION_MAX_LENGTH } from '../server/request-authentication.js';
 export const GATEWAY_SESSION_COOKIE = '__Host-atlas-artifact-session';
 export function gatewayReleaseCookieName(deploymentId) {
     if (!/^[a-zA-Z0-9_-]{1,128}$/.test(deploymentId))
@@ -16,6 +17,8 @@ catch {
     return false;
 } });
 const id = z.string().min(1).max(255);
+/** Only the authenticated Atlas bootstrap control reply supplies this private cookie member. */
+export const gatewayAuthenticationSchema = z.object({ method: z.literal('auth0_user'), sub: id }).strict();
 const sessionSchema = z.object({
     version: z.literal(1), kind: z.enum(['development', 'hosted', 'static']),
     sessionId: id.nullable(), deploymentId: id.nullable(),
@@ -24,6 +27,7 @@ const sessionSchema = z.object({
     bridge: artifactRequestContextSchema.shape.bridge,
     lattice: artifactRequestContextSchema.shape.lattice.optional(),
     taskRoutes: artifactRequestContextSchema.shape.taskRoutes,
+    authentication: gatewayAuthenticationSchema.optional(),
 }).strict().refine(value => value.kind === 'development'
     ? value.sessionId !== null && value.deploymentId === null && value.frameworkBuildId === null && !value.published
     // A static deployment has no Next build: its assets are named by the deployment itself.
@@ -33,7 +37,8 @@ const sessionSchema = z.object({
 function sameSessionScope(left, right) {
     return left.ownerId === right.ownerId && left.projectId === right.projectId &&
         left.environment === right.environment && left.publicOrigin === right.publicOrigin &&
-        left.kind === right.kind && left.published === right.published;
+        left.kind === right.kind && left.published === right.published &&
+        left.authentication?.method === right.authentication?.method && left.authentication?.sub === right.authentication?.sub;
 }
 /** Active use renews the idle window, but never extends the original admission's eight-hour bound. */
 export function renewGatewaySession({ session, authorizedExpiresAt, now = Date.now() }) {
@@ -161,3 +166,27 @@ export function signGatewayContext({ session, method, path, privateKey, keyId, n
     const signed = `${header}.${payload}`;
     return `${signed}.${sign(null, Buffer.from(signed), key).toString('base64url')}`;
 }
+/** Signs a proof only for the exact context this call just minted from its authenticated session. */
+export function signGatewayRequest(input) {
+    const requestContext = signGatewayContext(input);
+    const authentication = input.session.authentication;
+    if (!authentication || authentication.method !== 'auth0_user' || authentication.sub !== input.session.ownerId) {
+        return { requestContext };
+    }
+    // This is our own just-signed payload, never a caller-supplied context token.
+    const context = artifactRequestContextSchema.parse(JSON.parse(Buffer.from(requestContext.split('.')[1], 'base64url').toString('utf8')));
+    const header = Buffer.from(JSON.stringify({ alg: 'EdDSA', typ: 'JWT', kid: input.keyId })).toString('base64url');
+    const payload = Buffer.from(JSON.stringify({
+        purpose: 'artifact-request-authentication', v: 1, iss: context.iss, aud: context.aud,
+        authenticationMethod: authentication.method, sub: authentication.sub,
+        contextJti: context.jti, contextSha256: createHash('sha256').update(requestContext).digest('hex'),
+        projectId: context.projectId, environment: context.environment, method: context.method,
+        pathSha256: createHash('sha256').update(context.path).digest('hex'),
+        iat: context.iat, exp: context.exp,
+    })).toString('base64url');
+    const unsigned = `${header}.${payload}`;
+    const requestAuthentication = `${unsigned}.${sign(null, Buffer.from(unsigned), createPrivateKey(input.privateKey)).toString('base64url')}`;
+    if (requestAuthentication.length > ARTIFACT_REQUEST_AUTHENTICATION_MAX_LENGTH)
+        throw new Error('Artifact authentication proof exceeds the header limit');
+    return { requestContext, requestAuthentication };
+}

package/dist/gateway-main.js

@@ -10,6 +10,7 @@ import { RedisTunnelOwnership, RedisTunnelRelay } from './tunnel/redis.js';
 import { ArtifactRequestAdmission } from './gateway/admission.js';
 import { GatewayControlAdmission } from './gateway/control-admission.js';
 import { createIngressRuntime, IngressSecretsError } from './gateway/ingress-runtime.js';
+import { DatadogStartupError, waitForDatadogStartup } from './gateway/datadog-startup.js';
 function required(name) {
     const value = process.env[name];
     if (!value)
@@ -20,6 +21,7 @@ function required(name) {
 async function main() {
     if (process.env.ARTIFACT_NEXT_ENABLED !== 'true')
         throw new Error('Artifact Next gateway is disabled');
+    await waitForDatadogStartup({ env: process.env });
     const redisUrl = required('ARTIFACT_NEXT_REDIS_URL');
     if (new URL(redisUrl).protocol !== 'rediss:')
         throw new Error('Artifact tunnel routing requires private Redis with TLS');
@@ -135,9 +137,9 @@ async function main() {
     process.once('SIGINT', () => { void stop(); });
 }
 void main().catch((error) => {
-    // Only an ingress-secrets refusal is described: its message names variables, never values, by
-    // construction. Other errors (Redis, URLs) may carry connection strings.
-    const reason = error instanceof IngressSecretsError ? error.message : undefined;
+    // These startup refusals contain only fixed descriptions and configuration names.
+    // Other errors (Redis, URLs) may carry connection strings.
+    const reason = error instanceof IngressSecretsError || error instanceof DatadogStartupError ? error.message : undefined;
     process.stderr.write(`${JSON.stringify({ event: 'artifact_gateway.start_failed', ...(reason ? { reason } : {}) })}\n`);
     process.exit(1);
 });

package/dist/next-build.d.ts

@@ -15,7 +15,7 @@ export declare function resolveNextRepositoryId({ spec, repository, baseUrl, tok
     baseUrl: string;
     token: string;
 }): Promise<string>;
-export declare function submitNextBuild({ root, sourceRoot, manifest, projectId, baseUrl, getToken, provenance, repository, repositoryId, channel, out }: {
+export declare function submitNextBuild({ root, sourceRoot, manifest, projectId, baseUrl, getToken, provenance, repository, repositoryId, sourceEnvironment, sourceToken, channel, out }: {
     root: string;
     sourceRoot: string;
     manifest: ArtifactStudioNextManifest;
@@ -25,6 +25,8 @@ export declare function submitNextBuild({ root, sourceRoot, manifest, projectId,
     provenance: SourceProvenance;
     repository: string;
     repositoryId?: string;
+    sourceEnvironment?: string;
+    sourceToken?: string;
     channel: 'active' | 'preview';
     out?: string;
 }): Promise<number>;

package/dist/next-build.js

@@ -58,16 +58,16 @@ export async function resolveNextRepositoryId({ spec, repository, baseUrl, token
             return match[1];
     }
     catch { /* Opaque labels/SSH origins are valid preview provenance but cannot attest a release. */ }
-    throw new Error('Official Next.js releases require a Git Service repository in this Atlas environment. Push the reviewed revision, then run artifact deploy --repo <namespace>/<name> --ref main --env <env> (or --ref staging for a staging environment).');
+    throw new Error('Official Next.js releases require a Git Service repository in the selected source environment. Use --source-env <env> when its repository lives in another environment. Push the reviewed revision, then run artifact deploy --repo <namespace>/<name> --ref main --env <env> (or --ref staging for a staging environment).');
 }
 /**
  * A verified repository build names a commit and the application's directory in it;
  * anything else uploads the committed source snapshot. The repository root is omitted
  * so the request stays valid for Atlas versions that predate `sourceRoot`.
  */
-function nextBuildRequestBody({ manifest, files, commit, provenance, repository, repositoryId, sourceRoot, channel }) {
+function nextBuildRequestBody({ manifest, files, commit, provenance, repository, repositoryId, sourceEnvironment, sourceRoot, channel }) {
     if (repositoryId)
-        return { repositoryId, commit, ...(sourceRoot === '.' ? {} : { sourceRoot }), idempotencyKey: randomUUID(), channel };
+        return { repositoryId, ...(sourceEnvironment ? { sourceEnvironment } : {}), commit, ...(sourceRoot === '.' ? {} : { sourceRoot }), idempotencyKey: randomUUID(), channel };
     return {
         manifest,
         files: files.map(({ path, content, encoding }) => ({ path, content, encoding: encoding ?? 'utf8' })),
@@ -75,7 +75,7 @@ function nextBuildRequestBody({ manifest, files, commit, provenance, repository,
         idempotencyKey: randomUUID(), channel,
     };
 }
-export async function submitNextBuild({ root, sourceRoot, manifest, projectId, baseUrl, getToken, provenance, repository, repositoryId, channel, out }) {
+export async function submitNextBuild({ root, sourceRoot, manifest, projectId, baseUrl, getToken, provenance, repository, repositoryId, sourceEnvironment, sourceToken, channel, out }) {
     if (!provenance.gitCommit || !/^[a-f0-9]{40}$/i.test(provenance.gitCommit)) {
         throw new Error('Commit the application source before requesting a hosted build. Use artifact dev for uncommitted local development.');
     }
@@ -84,8 +84,12 @@ export async function submitNextBuild({ root, sourceRoot, manifest, projectId, b
     if (channel === 'active' && !repositoryId)
         throw new Error('An official release requires a verified Git Service repository.');
     const path = `/api/artifact-studio/projects/${encodeURIComponent(projectId)}/next`;
-    const body = nextBuildRequestBody({ manifest, files: source.files, commit: provenance.gitCommit, provenance, repository, repositoryId, sourceRoot, channel });
-    const response = operationSchema.parse(await postJson({ baseUrl, token: await getToken(), path: `${path}/builds${repositoryId ? '/from-repository' : ''}`, body }));
+    const body = nextBuildRequestBody({ manifest, files: source.files, commit: provenance.gitCommit, provenance, repository, repositoryId, sourceEnvironment, sourceRoot, channel });
+    if (sourceEnvironment && !sourceToken)
+        throw new Error('Cross-environment builds require a separately authenticated source session.');
+    const response = operationSchema.parse(await postJson({ baseUrl, token: await getToken(), path: `${path}/builds${repositoryId ? '/from-repository' : ''}`, body, ...(sourceEnvironment ? { headers: { 'x-sequence-source-authorization': `Bearer ${sourceToken}` } } : {}) }));
+    if (sourceEnvironment)
+        console.log(`[seq-studio] source: ${sourceEnvironment} / ${repository} -> target: ${baseUrl}`);
     const directory = repositoryId && sourceRoot !== '.' ? ` (${sourceRoot})` : '';
     console.log(`[seq-studio] Atlas build ${response.operation.id} (${channel}) from ${provenance.gitCommit.slice(0, 12)}${directory}`);
     console.log(`${baseUrl}/artifact-studio/projects/${projectId}`);

package/dist/sdk.d.ts

@@ -44,6 +44,8 @@ export interface SequenceApiFetchResponse<TBody = unknown> {
     headers?: Record<string, string>;
 }
 export interface SequenceApiUploadOptions {
+    /** Multipart binary field name. Defaults to file. */
+    fieldName?: string;
     timeoutMs?: number;
     /**
      * HTTP method for the multipart request. Defaults to POST; PUT is allowed